Trust No-One, Not Even Yourself Or The Weak Link Might Be Your Build Tools

No ratings

Presented at Blackhat USA 2004 by

David Maynor

Many advances have happened in the security arena over the last few years. With new technologies being deployed attackers are having to attack in and stealthier ways. The most impact would come from attacking an application before its built, or while its in the process of being built. Through a series of examples it will be clear that not only should you worry about what is in your code, but how it is built. Trojaning a compiler to automatically backdoor every binary being built is not only possible, its easy. This talk will show how the attack can occur and the results of it. This attack is not just limited to opensource compilers, Microsoft Visual Studio will be attacked as well.